True or False: SAML users are cached and written to file.

SAML (Security Assertion Markup Language) users are indeed cached and written to file in Splunk. This caching mechanism allows for quicker access and improved performance when authenticating SAML users. When a user logs in via SAML, the authentication process typically involves checks against the identity provider. Once authenticated, the user's information can be cached within Splunk for a specified duration, enabling smoother subsequent logins without requiring repeated communication with the identity provider each time.

This caching can significantly enhance the user experience by minimizing delays associated with authentication, especially in environments with a high number of SAML users. The written file serves as a local record, allowing Splunk to reference user permissions and other attributes efficiently. While there might be different configurations that govern how user data is managed, the fundamental behavior of caching SAML user information to optimize login processes is standard in Splunk.

This is why the statement in the question is true.